But this may be even more frightening to the person you're "reporting" the breach to, who is obviously no tech genius. Now they've been burgled by invisible elv

But this may be even more frightening to the person you're "reporting" the breach to, who is obviously no tech genius. Now they've been burgled by invisible elves. Even if the elves appear to have done nothing but leave behind delicious cookies and thoughtfully-written notes, it's pretty freaky to the uninitiated. They may literally change their locks and buy an alarm system. Worse, when some idiot comes along peddling a "magical charm to ward off the bad e-criminals that lurk invisibly on your Facebook page" they'll be in a nice receptive state of free-floating subliminal panic. The moral of this story is, I guess, is that as a solo whistleblower without institutional or cultural support all available options are bad. We are slowly educating the world's organizations - lots of sites and services these days have security officers who might understand the social dynamics of exploit reports and not be so quick to fly off the handle - but I'm sure there's room for a lot more basic training. Meanwhile, it's hard being a pioneer. ;)